git-watchtower 2.3.12 → 2.3.14

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "git-watchtower",
-  "version": "2.3.12",
+  "version": "2.3.14",
   "description": "Terminal-based Git branch monitor with activity sparklines and optional dev server with live reload",
   "main": "bin/git-watchtower.js",
   "bin": {

package/src/casino/index.js

@@ -7,6 +7,7 @@
  */
 
 const { ansi, box } = require('../ui/ansi');
+const sounds = require('./sounds');
 
 // ============================================================================
 // Casino Mode State
@@ -110,6 +111,18 @@ function disable() {
   // up to ~15 frames × 120 ms = 1.8 s after disable, and lossMessage stayed
   // set so isLossAnimating() reported true into the next session.
   resetLossState();
+  // Drop the marquee render callback so a stale closure to the previous
+  // session's render() doesn't survive across enable/disable cycles. In
+  // production this is mostly hygiene (bin/git-watchtower.js wires the
+  // callback exactly once at startup against a singleton render fn), but
+  // tests that re-use the casino module saw the previous test's callback
+  // persist into the next setRenderCallback assignment.
+  marqueeCallback = null;
+  // Cancel any pending sound timeouts (jackpot bell chains, multi-play
+  // mega-jackpot files) so audio doesn't continue after the user
+  // toggled casino mode off — and so child processes from the file-play
+  // path don't get spawned by a setTimeout that fires after shutdown.
+  sounds.cancelAll();
 }
 
 /**

package/src/casino/sounds.js

@@ -9,6 +9,44 @@ const { execFile } = require('child_process');
 const path = require('path');
 const fs = require('fs');
 
+/**
+ * Pending setTimeout handles for the multi-bell / multi-play chains used
+ * by playJackpot and playMegaJackpot. Tracked so casino.disable() (and
+ * shutdown) can cancel any in-flight chain instead of letting up to ~600
+ * ms of post-disable audio leak through.
+ * @type {Set<NodeJS.Timeout>}
+ */
+const _pendingTimeouts = new Set();
+
+/**
+ * Schedule a callback like setTimeout, but auto-track the handle so it
+ * can be cancelled by cancelAll() and auto-removes itself on fire.
+ * @param {Function} fn
+ * @param {number} delay
+ * @returns {NodeJS.Timeout}
+ * @private
+ */
+function _scheduleTracked(fn, delay) {
+  const handle = setTimeout(() => {
+    _pendingTimeouts.delete(handle);
+    try { fn(); } catch (e) { /* sounds are optional */ }
+  }, delay);
+  _pendingTimeouts.add(handle);
+  return handle;
+}
+
+/**
+ * Cancel every pending sound timeout. Idempotent. Called from
+ * casino.disable() so a jackpot fired moments before the user toggled
+ * casino mode off doesn't keep playing afterward.
+ */
+function cancelAll() {
+  for (const handle of _pendingTimeouts) {
+    clearTimeout(handle);
+  }
+  _pendingTimeouts.clear();
+}
+
 // ============================================================================
 // Sound Configuration
 // ============================================================================
@@ -133,10 +171,11 @@ function playJackpot() {
   if (soundPath) {
     playFile(soundPath, VOLUME.jackpot);
   } else {
-    // Multiple bells for jackpot!
+    // Multiple bells for jackpot! Tracked so casino.disable() can
+    // cancel mid-chain — see _scheduleTracked / cancelAll.
     playBell();
-    setTimeout(playBell, 200);
-    setTimeout(playBell, 400);
+    _scheduleTracked(playBell, 200);
+    _scheduleTracked(playBell, 400);
   }
 }
 
@@ -146,14 +185,14 @@ function playJackpot() {
 function playMegaJackpot() {
   const soundPath = getSoundPath('jackpot');
   if (soundPath) {
-    // Play jackpot sound multiple times
+    // Play jackpot sound multiple times. Tracked for cancellation.
     playFile(soundPath, VOLUME.jackpot);
-    setTimeout(() => playFile(soundPath, VOLUME.jackpot), 300);
-    setTimeout(() => playFile(soundPath, VOLUME.jackpot), 600);
+    _scheduleTracked(() => playFile(soundPath, VOLUME.jackpot), 300);
+    _scheduleTracked(() => playFile(soundPath, VOLUME.jackpot), 600);
   } else {
     // Lots of bells!
     for (let i = 0; i < 5; i++) {
-      setTimeout(playBell, i * 150);
+      _scheduleTracked(playBell, i * 150);
     }
   }
 }
@@ -240,6 +279,7 @@ module.exports = {
   playSpin,
   playLoss,
   playForWinLevel,
+  cancelAll,
   getSoundPath,
   SOUNDS_DIR,
 };

package/src/server/web.js

@@ -46,6 +46,36 @@ const SSE_KEEPALIVE_INTERVAL = 15000;
  */
 const MAX_STALLED_PUSHES = 60;
 
+/**
+ * Content-Security-Policy header for the dashboard HTML.
+ *
+ * The dashboard uses inline <script> and inline <style> blocks (the whole
+ * UI is bundled at build time), and makes XHR / EventSource calls to
+ * /api/... on the same origin. No external resources are loaded.
+ *
+ * `default-src 'none'` denies everything not explicitly allowed.
+ * `script-src` / `style-src` need 'unsafe-inline' for the bundled blocks.
+ * `connect-src 'self'` lets XHR + SSE hit /api/... .
+ * `base-uri 'none'` blocks <base> injection from rewriting URLs.
+ * `form-action 'none'` blocks any rogue form posts.
+ * `frame-ancestors 'none'` blocks embedding (defense vs. clickjacking).
+ *
+ * Defense-in-depth — the dashboard already escapes user-supplied content
+ * everywhere we render it, but a future regression that forgets escHtml
+ * is mitigated here.
+ */
+const CONTENT_SECURITY_POLICY = [
+  "default-src 'none'",
+  "script-src 'self' 'unsafe-inline'",
+  "style-src 'self' 'unsafe-inline'",
+  "connect-src 'self'",
+  "img-src 'self' data:",
+  "font-src 'self'",
+  "base-uri 'none'",
+  "form-action 'none'",
+  "frame-ancestors 'none'",
+].join('; ');
+
 /**
  * Actions the web dashboard is allowed to POST to /api/action. Every entry
  * here MUST be matched by a `case` in `handleWebAction` in bin/git-watchtower.js
@@ -474,7 +504,12 @@ class WebDashboardServer {
 
     // Routes
     if (pathname === '/' && req.method === 'GET') {
-      res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+      res.writeHead(200, {
+        'Content-Type': 'text/html; charset=utf-8',
+        'Content-Security-Policy': CONTENT_SECURITY_POLICY,
+        'X-Content-Type-Options': 'nosniff',
+        'Referrer-Policy': 'no-referrer',
+      });
       res.end(this._cachedHtml);
       return;
     }
@@ -673,4 +708,5 @@ module.exports = {
   STATE_PUSH_INTERVAL,
   MAX_STALLED_PUSHES,
   ALLOWED_ACTIONS,
+  CONTENT_SECURITY_POLICY,
 };